CVE-2025-47580 is a medium severity missing authorization flaw (CVSS 5.4) in the Front End Users plugin for WordPress, versions through 3.2.35. When Patchstack last published its entry, no official patch was listed, so check for a newer release or plan to replace the plugin.
What's affected
The record says Front End Users by Rustaurius, slug front-end-only-users, is affected through 3.2.35. Patchstack's entry states that no official patch was available when it was written.
The record's vector lists low privileges, while Patchstack's page lists the required privilege as unauthenticated. Treat the lower bar as the safe assumption, and confirm against the current plugin release.
The record does not mark CVE-2025-47580 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=front-end-only-users --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
Check the changelog on the plugin's WordPress.org page for any version above 3.2.35 that mentions an access control fix. If you find none, assume you are exposed.
What to do now
- Update Front End Users to a fixed release if one has appeared since this review. With WP-CLI that is
wp plugin update front-end-only-users. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- If the plugin handles member sign ups or profiles, review the user list for accounts you did not expect and check whether personal data is shown to the wrong roles.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-862, missing authorization. Authentication asks who you are. Authorization asks what you may do. When a plugin checks the first but not the second, or checks neither, a user can reach actions and data meant for other roles.
The fix belongs in code: every request that reads or changes data needs a permission check on the server. With no patch confirmed, the practical choices are to replace the plugin, limit who can register, or add rules in front of the site.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Quick check
Is there a patch for CVE-2025-47580?
Patchstack listed no official patch when it published the entry. Check the plugin changelog for anything newer than 3.2.35.
What is missing authorization?
It means a feature runs without checking whether the user is allowed to use it. Logging in is not the same as being permitted.
Sources
Last reviewed: 18 October 2026.
